Apple’s tracking and fingerprinting is changing this fall. The new Safari update will remove GCLID (Google Click Identifier) parameters and other click identifiers from URLs in standard browsing mode. The current beta mode is not yet stripping the GCLID in regular sessions (only in Safari Private Mode). However, the official release might extend this restriction more comprehensively.

The digital marketing community is in a state of high alert. Recent testing and reports from the latest iOS 26 developer betas have sent a fresh wave of uncertainty through the industry, with a central question echoing across forums and virtual conference calls: What is truly being affected by Apple’s upcoming Safari update?

Initial reports painted a dire picture, suggesting that the Safari 2025 update would unilaterally strip all tracking parameters, leaving marketers to navigate a future of complete data darkness. However, a closer look at these developments, including the specifics of the new Advanced Tracking & Fingerprinting Protection, reveals a more nuanced and, in some ways, more complex reality.

In this article, we will discuss the plausible impacts on digital-first businesses and immediate solutions to adopt before it’s too late (shift to first-party data and server-side tagging).

What is Changing with Safari’s Update?

Currently, Safari is stripping click identifiers only in private mode. The upcoming release, should it impact regular browsing sessions as well, will cause a massive hit in data loss for Google Ad Campaigns. Currently, it is removing click identifiers in three specific scenarios:

• Private Browsing Mode
• Links from Apple Messages
• Links from Apple Mail

Here’s the twist. The September 2025 update will extend this removal to standard browsing sessions. This means that every Safari user’s identifiers will be stripped before they even reach your website.

Parameters that Safari will remove:

Second Twist is here: Safari will retain utm_source and utm_campaign parameters since these track campaigns at aggregate levels instead of individual users.

This update, part of Apple’s Advanced Tracking & Fingerprinting Protection, will extend the removal of key click identifiers such as gclid, fbclid, and msclkid from private browsing to all standard browsing sessions. For marketers, this means the once-reliable foundation of client-side attribution is being systematically dismantled. The stakes are high: without a solution, your ad platforms will receive incomplete data, leading to under-reported conversions, ineffective Smart Bidding algorithms, and a direct hit to your return on investment (ROI).

The click identifiers are unique parameters that are appended to a URL when a user clicks on an ad. These long strings of characters act as a bridge, linking a specific ad interaction to a subsequent conversion on a business’s website. They act as the foundation layer for accurate conversion attribution, allowing platforms to understand which campaigns are driving valuable actions, from a lead submission to a complete purchase.

Safari’s update is designed to cut this bridge. By automatically stripping these identifiers from URLs in all browsing sessions, there might be serious consequences for marketers, such as –

1. Data gaps

The removal of GCLID in Safari creates significant blind spots in campaign reporting. While UTM parameters still allow you to see traffic and conversions attributed to Google Ads at a campaign or channel level, you lose click-level accuracy. Without GCLID, conversions cannot be tied back to specific ads, keywords, or audiences, making it harder to optimize bidding and measure true ROI.

2. Misleading ROI

As conversions go untracked and are misattributed, your campaign performance will appear artificially low. This underreporting can lead to a critical misjudgment of your return on investment (ROI), causing you to pause or pull budget from campaigns that are actually highly effective.

3. Algorithm breakdown

Ad platforms rely on a constant stream of accurate conversion data to feed their machine learning algorithms. Google’s Smart Bidding, for instance, uses this data to optimize bids in real time and find new customers. With incomplete data from Safari users, these algorithms will become less effective, leading to a decline in campaign performance over time.

4. Audience shrinkage

The data collected from these click identifiers is also used to build and refresh retargeting and custom audiences. As a significant portion of your Safari-using audience can no longer be accurately identified, these valuable remarketing lists will shrink, limiting your ability to re-engage with them through paid channels.

While the technical solutions for Safari’s click identifier removal are essential for survival, they are not the whole story. The real opportunity for marketers lies in moving beyond these tactical workarounds and adopting a new strategic framework for digital attribution. This is not merely a problem to be solved, but a catalyst that forces a permanent pivot away from the fragile, client-side tracking of the past toward a more resilient, direct, and privacy-compliant data infrastructure.

How to Solve Safari Update with Server-side & First-party Data?

Unlike third-party cookies or browser-based click identifiers, this data is owned by the business and is not susceptible to the kind of privacy restrictions imposed by browsers like Safari. One of the most effective methods to implement a first-party data strategy is through Enhanced Conversions for Google Ads. This feature improves conversion measurement by using hashed, first-party data collected at the point of conversion to match a conversion to an ad click.

• Data Collection: At the point of a conversion (e.g., a purchase or a lead form submission), you collect first-party customer data, such as an email address, name, home address, or phone number.
• Data Hashing: Before this data is sent to Google, it is “hashed” using a secure, one-way encryption algorithm called SHA256. This process transforms the data into an anonymous string of characters, ensuring that no personally identifiable information is ever sent to Google.
• Attribution Match: Google receives this hashed data and matches it against its own hashed user data from its platforms (e.g., Gmail, Google accounts) to identify the specific ad interaction that led to the conversion. This method bypasses the need for a gclid or any other URL parameter for attribution.

Enhanced Conversions can significantly improve conversion accuracy, with some reports suggesting an uplift of 20-30%. This method is a key component of a privacy-compliant, future-proof measurement strategy because it does not rely on browser-based cookies or URL parameters.

The most robust and sustainable first-party data strategy involves direct server-to-server communication with ad platforms. This approach sends conversion events directly from your server, bypassing the user’s browser entirely.

• Meta Conversions API (CAPI): For Meta, a simple backup parameter is not a viable solution. The recommended approach is to implement the Conversions API (CAPI). CAPI sends conversion data and customer information directly from your server to Meta’s servers, which is not affected by ad blockers, cookie restrictions, or browser privacy settings.  
• Google Ads API: In addition to Enhanced Conversions, the Google Ads API allows you to upload conversions directly to your account using customer data and order IDs . This is particularly useful for tracking offline conversions, such as phone orders, and attributing them to your digital campaigns.
• Other Platforms: This same principle applies to other advertising platforms. For instance, you can use the TikTok Events API to maintain attribution through server-side transmission.

How to Solve Safari Update: Server-side with First-party Data

There are two ways to handle the upcoming changes: client-side or server-side.

Client-side solutions might be technically possible, but they come with certain drawbacks. You will need to set a GCLID cookie for each user manually, monitor it constantly, and update it whenever Google changes the cookie’s name or format. Since these updates are not yet announced or documented, this approach can quickly become unreliable and time-consuming.

Server-side tracking is a safer approach. This method requires setting up GA4 (at least the page_view event), which, along with Conversion Linkers on sGTM, will handle everything automatically. The native Conversion Linker will set the GCLID cookie correctly, even if Google updates the format or name. This means you don’t need to worry about manually fixing or missed conversions.

Server-side tracking gives you reliable tracking, accurate reports, and you continue to have complete visibility of your campaigns (including for users browsing on Safari).